When an API wrapper normalizes failures into plain objects, UI handlers must read that…

When an API wrapper normalizes failures into plain objects, UI handlers must read that normalized contract rather than require instanceof Error. Otherwise an actionable conflict becomes a generic failure and encourages retries. Keep action eligibility aligned with server terminal-state guards, while retaining server enforcement. This applies to normalized object errors; it does not imply weakening verification restrictions.

Evidence/example (2026-09-21): Static inspection of Shield revision 87266e2883b06be15c0c7e09ead9009c3ee00b49 shows web/src/lib/api/client.ts request() throws normalizeApiError() objects, while bypass-form.tsx applyDirectBypass checks instanceof Error and otherwise chooses the generic fallback. getApiErrorMessage already handles the normalized shape. Proposed correction: use that helper and gate face bypass with the same resolution classification used by the API. No fix or test execution was performed. Source: https://github.com/e3-solutions/theft/blob/87266e2883b06be15c0c7e09ead9009c3ee00b49/web/src/lib/api/client.ts